Guidance · Situation

I've just become CISO

The first 90 days in a security function someone else built.

Why this moment is hard

Everyone will tell you what works, and most of it will be a claim you cannot yet check. You have the least authority you will ever have, at the moment people expect the most decisions. And the few things that cannot wait, such as open incidents and your predecessor's access, are the easiest to miss in the first week.

5 Guidance questions3 pack documents1 toolAbout 3 h 20 min of reading in all

This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.

First, the decisions

Guidance · Leading the security function
What do I do in my first 90 days as a new CISO?
6 decision points · about 10 min to read
Why here Start with the whole arc: what the first week, the listening weeks and day 90 each have to produce.
Guidance · Leading the security function
Which decisions can I make myself in my first months, and which do I share or escalate?
9 decision points · about 10 min to read
Why here Before you decide anything, know which decisions are yours, which you share and which you escalate.
Guidance · Leading the security function
How do I decide who to interview first, and what to ask?
7 decision points · about 10 min to read
Why here Interviews come before checking, and the order of who you see opens or closes the next doors.
Guidance · Leading the security function
How do I find out what an inherited security programme really does, as opposed to what it claims?
6 decision points · about 10 min to read
Why here Then test what you were told against records, tests and system views.
Guidance · Leading the security function
How do I build a hundred-day plan that mixes quick wins with the decisions that take longer?
9 decision points · about 10 min to read
Why here Only once discovery ends do you have the facts a 100-day plan needs.

Then, the documents

RACI / Responsibility Matrix · P27-A06
Transition Decision Rights Matrix
CISO Transition, Handover & First 90 Days · about 25 min to read
Why here Agree your authority in writing with the sponsor in the first fortnight.
Assessment / Questionnaire · P27-A03
Inherited Security Programme Discovery Workbook
CISO Transition, Handover & First 90 Days · about 25 min to read
Why here The workbook you fill during discovery, area by area, with Evidenced, Described only, Not found or Contradicted.
Plan / Programme · P27-A07
100-Day Security Plan
CISO Transition, Handover & First 90 Days · about 30 min to read
Why here Turns the findings into quick wins, stabilisation items and strategic decisions.

Finally, a tool

Tool
Where are our gaps? — ISO/IEC 27001 2022
118 requirements · About 70 minutes · No account needed
Why here Run it near the end of discovery, as a second view of what the programme can actually evidence.

If your start looks different

If your predecessor left without a handoverIf my predecessor left without a handover, then how do I rebuild what I need?7 decision points · about 10 min to read
If they are still here: the handover document to ask for before they goSecurity Function Handover DocumentCISO Transition, Handover & First 90 Days · about 25 min to read
If you have inherited an ISO 27001 project that has not started or has stalledWe have decided to get ISO 27001 certified23 steps · about 7 h 35 min of reading

Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.